MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d7228a12529e07a5ce561381f1eaef4be4b8ce5b35615a1f58a5f1ffdee0d069. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	d7228a12529e07a5ce561381f1eaef4be4b8ce5b35615a1f58a5f1ffdee0d069
SHA3-384 hash:	da98f3ffdaaabed533c091745ac7181f6a192730112bd4dbda71fbe41d41cc399177cf2ba65cbdc033a820db84d22d41
SHA1 hash:	30882cfa5440f106a804a7d98de463b7a966c6b0
MD5 hash:	ddd171110ebeae98e3854cbc3dfe98a0
humanhash:	alaska-quebec-table-lactose
File name:	s7n.mips
Download:	download sample
Signature	Gafgyt Alert Create hunting rule
File size:	88'724 bytes
First seen:	2026-02-08 13:58:33 UTC
Last seen:	Never
File type:	elf
MIME type:	application/x-executable
ssdeep	1536:XRf7pE8OP5tMBZrIPIbdwDFK41zF9xWssue69MSF7tFIV0H4Kk/qH3IE7:h7pa3s0Ihqk41p9xVsueXK7tKViyqXIU
TLSH	T14B8302348D449FBBCEF34D3217099A244FF54E78336E6C341950A683E9534A5B682EDB
Magika	elf
Reporter	abuse_ch
Tags:	elf gafgyt

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

49

Origin country :

DE

Vendor Threat Intelligence

ACCE Unknown

No detections

InQuest

Result

Gathering data

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

elf.32.be

First seen:

2026-02-02T22:27:00Z UTC

Last seen:

2026-02-03T08:46:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/d7228a12529e07a5ce561381f1eaef4be4b8ce5b35615a1f58a5f1ffdee0d069/results?tab=lookup

Kunai Sandbox

Status:

Failed

Link:

https://sandbox.kunai.rocks/analysis/cdbd125f-67eb-4722-a2e2-a65c3c3bcb6b

Intezer Unknown

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/960b21f6-22a2-4460-8768-8a1f74e2f271

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

troj.evad

Score:

64 / 100

Link:

https://www.joesandbox.com/analysis/1865640

Signature

Drops files in suspicious directories

Multi AV Scanner detection for submitted file

Sample tries to persist itself using cron

Sample tries to persist itself using System V runlevels

Sample tries to set files in /etc globally writable

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

ELF

Link:

https://malprob.io/report/d7228a12529e07a5ce561381f1eaef4be4b8ce5b35615a1f58a5f1ffdee0d069

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/d7228a12529e07a5ce561381f1eaef4be4b8ce5b35615a1f58a5f1ffdee0d069/

ReversingLabs TitaniumCloud Linux.Trojan.Gafgyt

Threat name:

Linux.Trojan.Gafgyt

Alert

Create hunting rule

Status:

Suspicious

First seen:

2026-02-03 02:47:31 UTC

File Type:

ELF32 Big (Exe)

AV detection:

11 of 36 (30.56%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=24riuesstyd2ltswcoa7d2xpjpslrts3gvqvuh2yuxy77xxa2buq._file

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  7/10

Tags:

discovery execution persistence privilege_escalation

Link:

https://tria.ge/reports/260208-rajx6aew7d/

Behaviour

Enumerates kernel/hardware configuration

Reads runtime system information

System Network Configuration Discovery

Changes its process name

Creates/modifies Cron job

Modifies init.d

Modifies rc script

Modifies systemd

Unexpected DNS network traffic destination

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.